Nobody thinks about the humble "Contact Us" form until it turns into a loaded gun pointed at your server. That's the mood in Drupal-land this week after the security team dropped a critical remote code execution bug in the Webform module — the one powering contact forms, surveys, and intake forms on a huge swath of the Drupal web.
The Bug Hiding in Your Submit Button
On September 23, 2026, the Drupal Security Team published 36 advisories covering 16 contributed projects — and a staggering 20 of them were for Webform alone. The headline flaw, SA-CONTRIB-2026-175 (CVE-2026-96355), scored a critical 18 out of 25: Webform fails to properly exclude certain format templates from token replacement, letting an attacker submit data that gets evaluated as template code when the submission renders.
Translation: on a site with a custom multiple-value item format using submission-value tokens, a form submission itself can become executable code. Depending on configuration, that opens the door to information disclosure, stored XSS, or full remote code execution.
Why This One Actually Matters
Webform isn't some niche add-on — it's one of the most widely installed modules in the Drupal ecosystem, sitting behind login-free, public-facing forms on government sites, universities, healthcare portals, and yes, probably your own "Get a Quote" page. An RCE that an anonymous visitor can trigger just by filling out a form is about as bad as contributed-module bugs get.
The silver lining: this isn't a zero-day being actively exploited in the wild, and the fix is a straightforward version bump — 6.2.12 for the 6.2.x branch, 6.3.1 for 6.3.x. But "straightforward" only helps if someone's actually running the update, and plenty of sites are still coasting on modules they installed in 2019 and forgot about.
Patch Tuesday energy, but for your contact form — don't let this one sit in the backlog.
If your Drupal site hasn't had a security module audit since the last time you checked, that's exactly the kind of thing our team lives for — let's get your modules current before an attacker finds out you didn't.
Source: The Drop Times